CVE-2026-97756: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-97756 and classified under CWE-122, involves a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw remotely to execute arbitrary code without privileges but requires user interaction. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability, and it is applicable to multiple versions of Microsoft 365 Apps for Enterprise as specified.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected environment. The attack requires user interaction but no privileges or authentication, making it a significant risk if unpatched.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided security updates from Microsoft promptly to remediate this issue. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97756 for detailed update instructions and confirmation of patch status.